Деякі з цих документів наразі публікуються лише англійською та німецькою. Переклади готуються; англійський текст — це версія, яка має силу.
Privacy notice
Grow Pro®, Grow_Pro_Privacy_Policy_v1_10
| Document | Grow_Pro_Privacy_Policy_v1_10 |
|---|---|
| Version | 1.10 |
| Last updated | 29 September 2026 |
| Data controller | Gro Pro Ltd, company number 15243559, C/O AJS Accountants Ltd, Gibson House, Ermine Business Park, Huntingdon, PE29 6XU |
| Contact | hello@growproltd.com |
| ICO registration | ZC126801 |
This is the plain account of what Grow Pro® holds about you, who else sees it, how long we keep it, and what you can do about it. It is written to be read. If any of it is unclear, email hello@growproltd.com and we will explain.
Two things we would rather you read before you need them than after:
- If you order a soil test, the laboratory gets your name and delivery address, because they post the kit straight to you. Section 3 says exactly what they get.
- If you buy something and later delete your account, the record of the sale stays for six years, because HMRC require it. We also keep an anonymous record of what grew and what wildlife visited — the plants, the habitat features, the sightings, and your region, with nothing that says whose garden it was. We keep that one indefinitely, to build a picture of what grows and what helps wildlife where, and it cannot be traced back to you. Everything else goes. Section 5 says exactly what stays.
1. What we hold about you
Your account. Your email address; a display name if you choose to give one; when you joined and when you last signed in; and a password if you set one, which is stored hashed, so nobody, including us, can read it. We do not ask for your name to open an account.
Your garden. Your country and postcode, your garden's type, size and shape, where the sun falls, the zones you have marked out, and the plants you have chosen or would like to grow. The postcode is what lets us tell you your soil, frost dates and growing conditions.
Your own writing. Notes, the names you give plants and zones, harvest records and spending records.
A soil test order. The name and address the kit is delivered to, the zones you are testing, the plot references printed on the sample bags, the results when they come back, and a payment reference.
Support. Any message you send us, so we can answer it and remember it if you come back.
What we do not hold. Your card details, which go straight to Stripe and never touch our systems. Your precise location: we use the postcode you give us and do not track you. Photographs: there is no way to upload one today. Dates of birth or identity documents.
2. Why we use it, and the lawful basis
UK law asks us to name a lawful basis for each use. There are three here.
| What we do | Basis |
|---|---|
| Run your account and your garden record, send sign-in links and receipts, answer support | Performing our contract with you |
| Arrange your soil test: pass your delivery details to the laboratory, match the results back to your zones, take payment | Performing our contract with you |
| Keep the sale record for six years | Legal obligation (HMRC) |
| Work out your soil, frost dates and growing conditions from your postcode; fix errors and keep the app secure; read the questions people ask the gardening assistant so we can improve the answers, without seeing who asked | Our legitimate interest in making the app work, which we have assessed and which does not override your rights |
| Make an anonymous record of the plants grown, habitat features built and wildlife seen, by region, when an account is deleted, so that we can learn what grows and what helps wildlife where | Our legitimate interest covers the making of it. Once made it is no longer personal data, because nothing in it can be traced to you |
| Measure how people find and use the site (analytics) | Your consent, given in the cookie banner. Nothing runs until you say yes, and you can say no or change your mind at any time |
We do not use your data for anything you would not expect from reading this page. We do not sell it, and we do not share it for anyone's advertising.
3. Who else sees it
A small number of companies do part of the work. Each gets only what its job needs.
| Who | What they get | Why | Their role |
|---|---|---|---|
| Richard Austin Agriculture Ltd, our soil laboratory (UK). Company number 06936430, Little Field, Fen Road, Frampton West, Boston, Lincolnshire, PE20 1RZ | Your name and delivery address, and the sample references, so the kit reaches you and the results reach the right zone. The sample bag carries a reference, not your name | To post you the kit and analyse your sample. They invoice us; you have no account with them | A controller in their own right. Their own privacy policy applies to what they hold, and they keep it for up to seven years |
| Stripe, payments | The payment itself. Your card details go to Stripe and never to us | To take payment | Processor |
| Mailgun (EU), email sending | Your email address and the content of the email | To send sign-in links, receipts and laboratory notices | Processor |
| Sentry (EU), error reporting | Technical error reports. Email addresses, postcodes and sign-in links are stripped out before anything is sent | To find and fix faults | Processor |
| Laravel Cloud, hosting | Everything in your account, because that is where the app and its database run | To run the app | Processor |
| Google Workspace, our own email | Whatever is in an email you send us, and the copy of laboratory results that reaches us | To read and answer email | Processor |
| Google Analytics and Microsoft Clarity | Anonymised usage: how people arrive, what they do, where they get stuck. Only if you accept analytics in the cookie banner | To see which parts of the site work and which advertising is worth paying for | Processor. Nothing is set until you consent |
Your data stays in the UK and the EU.
4. The gardening assistant
The question you type to the assistant is personal data, so here is what happens to it. We keep the question, what we matched it to, and whether we found you an answer. It is answered from our own reference tables on our own systems and is not sent to any other company. When we read questions to improve the answers, we see the question and not who asked it. Questions are kept while you have an account and go when you delete it.
5. How long we keep it
| What | How long |
|---|---|
| Your account, garden, writing and assistant questions | Until you delete your account. Deleting it removes them: gone from our live systems within 30 days and from backups within 90 |
| Support messages | Until you delete your account |
| Sale records | Six years from the end of the financial year the sale falls in (our year ends 31 October), because HMRC require it. They are kept even if you delete your account. They hold the sale, not your garden: the order reference, date, what you bought, what you paid, VAT, your name and billing address, and the invoice. Kept beside them for the same six years: the record that you accepted our terms when you bought, and the log that your deletion request was carried out |
| Account deletion logs | Destroyed once their six years are up |
| The anonymous garden record, made when you delete | Kept, with no end date. It holds three things and your region: the plants you grew (by our plant reference, with how many, by month), the habitat features you ticked, the wildlife you recorded (species, month, count), and your region (one of about thirty, such as "East Anglia" or "Bayern") — never your postcode, your address, your email, your name, your notes, the names you gave things, your garden's shape or size, or your harvests. There is no key back to you: it cannot be joined to anything that identifies you, by us or by anyone. We keep it so that we can see across many gardens what grows and what helps wildlife where, which is a picture no single garden shows. If any of it is ever published or passed to anyone outside the company, we check first that no single garden can be picked out |
Our Data Retention and Deletion Policy holds the full schedule and prevails if anything here disagrees with it.
6. Your rights
You can see what we hold, correct it, and delete it. You can object to anything we do on the basis of legitimate interest, and withdraw consent to analytics at any time from "cookie preferences" in the footer.
You can delete your account yourself, from your account settings, and it really deletes it. You do not have to ask us. The only things that stay are the sale records named in section 5, the log that proves we deleted the rest, and the anonymous garden record, which has no way back to you. Where you have had a soil test we pass your request to the laboratory too, but they hold their own record as a controller in their own right and it is their decision, not ours.
For anything else, email hello@growproltd.com. We answer within one month.
7. Cookies
Our Cookie Policy lists everything we set in your browser. The short version: three cookies that make the site work, and analytics only if you say yes.
8. Age
Grow Pro® is not aimed at children. You must be 13 or over to hold an account, and if you are under 16 you may need a parent or guardian's consent. The family activities in the app are for a parent to run. We do not set marketing cookies for anyone, and we do not knowingly collect data from a child under 13; if you think we have, tell us and we will delete it.
9. Changes
We may update this notice. If the change matters we tell you in the app or by email before it takes effect, and the version and date at the top change.
10. Complaints
If you are unhappy with how we handle your data, tell us first at hello@growproltd.com. You also have the right to complain to the Information Commissioner's Office at ico.org.uk. Gro Pro Ltd is on the ICO register under ZC126801 (ico.org.uk/ESDWebPages/Entry/ZC126801).
Document control
| Version | Date | Author | Summary of changes |
|---|---|---|---|
| 1.10 | 2026-09-29 | Chris | Version 1.9, with one thing taken out on the founder's instruction of 29 September: the sentences saying the anonymous garden record might be used, shared or sold commercially. There is no buyer for it and none is being looked for, and the founder's ruling is that a notice should not raise a possibility the company is not pursuing. So the notice now says what does happen and nothing more — the record is anonymous, it is kept with no end date, it cannot be traced back to anybody, and it is kept so we can see across many gardens what grows and what helps wildlife where. Three places carried the old wording: the opening bullet, the lawful-basis row in section 2 and the schedule row in section 5. The release check written into 1.9 is kept, reworded as a condition rather than a plan: if any of this record is ever published or passed outside the company we check first that no single garden can be picked out. Checking that a person cannot be identified is worth doing whoever the reader is, and dropping it would have left the notice weaker than 1.9. Nothing else in 1.9 is changed. Section 2's existing promise that we do not sell your data now reads consistently with the rest of the notice |
| 1.9 | 2026-09-27 | Chris | The founder's answers of 27 September applied to the anonymous garden record: it is made automatically, with no tick box (the general right to object in section 6 remains, as the law requires); and it holds only plants, habitat features, wildlife sightings and region — harvests, garden type, size band, soil type and account age dropped. A one-line promise added that nothing leaves us until we have checked no single garden can be picked out. Issued but never published in this form; 1.10 is the version that went out |
| 1.8 | 2026-09-27 | Chris | The anonymous garden record added, on the founder's instruction of 27 September that plant and biodiversity information should outlive an account: what it holds (plants, habitat features, wildlife sightings, harvest quantities, garden type and size band, region), what it never holds (postcode, address, email, name, notes, given names, garden shape), that there is no key back to the person, and that the person can tick a box at deletion to keep nothing. Said in the opening lines, in the lawful-basis table, in section 5 and in section 6, so nobody meets it only after deleting. Region chosen as the location grain because a postcode district with a rare plant list could identify a garden |
| 1.7 | 2026-09-22 | Chris | Rewritten to the founder's brief of 22 September, which set out what the live app holds, shares and keeps, so that the notice describes the app that is going live rather than the one planned in April. Section 1 now lists the account, garden, writing, soil-test and support data as held (display name, sign-in dates, hashed password, garden type and shape, harvest and spending records, plot references and payment reference were not named before); postcode stated as the postcode given, not the district, because the soil lookup now works below district level. Section 2 reduced to the three bases the brief names, with the HMRC obligation kept as a fourth. Section 3 names every recipient by name: Mailgun (EU), Sentry (EU, with the stripping of emails, postcodes and sign-in links), Laravel Cloud and Google Workspace, none of which the previous version named; Microsoft Clarity added beside Google Analytics as consent-only. DJL Agriculture removed, because the brief lists no product supplier among what the live app shares with; it returns when products are sold. Section 5 rewritten to the brief's three periods, the six-year sale record said at the top of the notice and again in full. The two things the founder asked to be said well, the laboratory receiving the name and address and the sale record surviving deletion, are the first two sentences after the title. Photographs and AI-provider sections dropped as describing things that do not exist; the assistant section kept, shortened. Age stated (13, parental consent under 16, family activities for a parent to run) rather than a children's section |
| 1.6 | 2026-09-03 | Chris | Four gaps closed after an audit against the ROPA: three things survive deletion, not one; VAT and the invoice in the sale record; five lawful bases added, including the one for Sage questions; hosting, email and Google Analytics added to the recipients; DJL described as acting on written instructions since the agreement was unsigned |
| 1.5 | 2026-09-02 | Chris | Every photograph we display carries its photographer and licence, checked at v9.85 |
| 1.4 | 2026-09-01 | Chris | Names collected only when there is something to post; photographs removed throughout because there is no way to upload one |
| 1.3 | 2026-09-01 | Chris | Corrected to what the application does: Sage keeps the question and the match, never the answer; no AI provider; no plant identification |
| 1.2 | 2026-09-01 | Chris | Six-year sale record said out loud; Sage section added; effective date set |
| 1.1 | 2026-09-01 | Chris | Laboratory recorded as a controller in its own right; DJL added; postcode corrected from sector to district |
| 1.0 | 2026-04 | Chris | Initial draft |
Gro Pro Ltd | Grow Pro® UK Trade Mark No. UK00004034914
Волієш поговорити з людиною? Напиши нам, і відповість людина.
hello@growproltd.com